@fuzdev/fuz_app 0.99.0 → 0.101.0

package/dist/dev/setup.d.ts

@@ -96,12 +96,20 @@ export declare const generate_random_key: (deps: CommandDeps) => Promise<string>
 /**
  * Read a single env var from a dotenv-style file.
  *
+ * Delegates to `load_env_file` so the value is tokenized exactly like every
+ * other dotenv read — surrounding quotes, inline comments, and escapes are
+ * handled, and a leading `export ` is tolerated. Returns `undefined` when the
+ * file is absent or the variable is unset; a read error other than the file
+ * not existing (permission denied, I/O failure) propagates rather than being
+ * masked as "not found".
+ *
  * @param deps - file read capability
  * @param env_path - path to the .env file
  * @param name - the variable name to read
  * @returns the value, or `undefined` if the file or variable doesn't exist
+ * @throws Error if reading fails for any reason other than `ENOENT` / `NotFound`
  */
-export declare const read_env_var: (deps: Pick<FsReadDeps, "stat" | "read_text_file">, env_path: string, name: string) => Promise<string | undefined>;
+export declare const read_env_var: (deps: Pick<FsReadDeps, "read_text_file">, env_path: string, name: string) => Promise<string | undefined>;
 /**
  * Create an env file from its example template, auto-generating `SECRET_FUZ_COOKIE_KEYS`.
  *

package/dist/dev/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAQnD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAAC,EACjD,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAU5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA0B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAoB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAC,GAAG,CAAC,EAAE,WAAW,CAAA;CAAC,KAC3B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AASnD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACxC,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAG5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA0B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAoB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAC,GAAG,CAAC,EAAE,WAAW,CAAA;CAAC,KAC3B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}

package/dist/dev/setup.js

@@ -8,6 +8,7 @@
  *
  * @module
  */
+import { load_env_file } from '../env/dotenv.js';
 import { query_account_by_username, query_actors_by_account, query_create_account_with_actor, } from '../auth/account_queries.js';
 import { query_create_role_grant } from '../auth/role_grant_queries.js';
 /** Default logger using bracket format. */
@@ -49,23 +50,22 @@ export const generate_random_key = async (deps) => {
 /**
  * Read a single env var from a dotenv-style file.
  *
+ * Delegates to `load_env_file` so the value is tokenized exactly like every
+ * other dotenv read — surrounding quotes, inline comments, and escapes are
+ * handled, and a leading `export ` is tolerated. Returns `undefined` when the
+ * file is absent or the variable is unset; a read error other than the file
+ * not existing (permission denied, I/O failure) propagates rather than being
+ * masked as "not found".
+ *
  * @param deps - file read capability
  * @param env_path - path to the .env file
  * @param name - the variable name to read
  * @returns the value, or `undefined` if the file or variable doesn't exist
+ * @throws Error if reading fails for any reason other than `ENOENT` / `NotFound`
  */
 export const read_env_var = async (deps, env_path, name) => {
-    const stat = await deps.stat(env_path);
-    if (!stat?.is_file)
-        return undefined;
-    try {
-        const content = await deps.read_text_file(env_path);
-        const match = new RegExp(`^${name}=(.+)$`, 'm').exec(content);
-        return match?.[1]?.trim();
-    }
-    catch {
-        return undefined;
-    }
+    const env = await load_env_file(deps, env_path);
+    return env?.[name];
 };
 // === Setup helpers ===
 /**

package/dist/env/dotenv.d.ts

@@ -20,6 +20,9 @@ import type { FsReadDeps } from '../runtime/deps.js';
  * values keep `#` literal when no whitespace precedes it so URL fragments
  * like `KEY=https://x.com#frag` round-trip unchanged.
  *
+ * A leading `export ` on a line is ignored, so a shell-sourceable `.env`
+ * (`export KEY=value`) parses identically to a plain `KEY=value`.
+ *
  * Trailing whitespace on unquoted values is lost (the raw value is trimmed);
  * wrap the value in `"..."` or `'...'` to preserve surrounding spacing.
  *

package/dist/env/dotenv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dotenv.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/env/dotenv.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AAGH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAkCnE,CAAC;AAiEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GACzB,SAAS,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAC3C,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CASvC,CAAC"}
+{"version":3,"file":"dotenv.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/env/dotenv.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAqCnE,CAAC;AAiEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GACzB,SAAS,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAC3C,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CASvC,CAAC"}

package/dist/env/dotenv.js

@@ -19,25 +19,32 @@
  * values keep `#` literal when no whitespace precedes it so URL fragments
  * like `KEY=https://x.com#frag` round-trip unchanged.
  *
+ * A leading `export ` on a line is ignored, so a shell-sourceable `.env`
+ * (`export KEY=value`) parses identically to a plain `KEY=value`.
+ *
  * Trailing whitespace on unquoted values is lost (the raw value is trimmed);
  * wrap the value in `"..."` or `'...'` to preserve surrounding spacing.
  *
  * @param content - dotenv file content
  * @returns parsed key-value pairs
  */
-// Line tokenization (trim, skip empties/comments, split on first `=`) is
-// mirrored in `update_env_variable.ts`'s `find_last_key_line_index`.
+// Line tokenization (trim, skip empties/comments, strip a leading `export `,
+// split on first `=`) is mirrored in `update_env_variable.ts`'s
+// `find_last_key_line_index`.
 export const parse_dotenv = (content) => {
     const result = {};
     for (const line of content.split('\n')) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith('#'))
             continue;
-        const eq_index = trimmed.indexOf('=');
+        // tolerate a leading `export ` so shell-sourceable `.env` files parse
+        // the same as plain `KEY=value` ones
+        const assignment = trimmed.startsWith('export ') ? trimmed.slice(7) : trimmed;
+        const eq_index = assignment.indexOf('=');
         if (eq_index === -1)
             continue;
-        const key = trimmed.slice(0, eq_index).trim();
-        let value = trimmed.slice(eq_index + 1).trim();
+        const key = assignment.slice(0, eq_index).trim();
+        let value = assignment.slice(eq_index + 1).trim();
         if (value.startsWith('"')) {
             const close = find_closing_double_quote(value);
             if (close !== -1 && is_comment_or_empty_after(value, close)) {

package/dist/env/update_env_variable.d.ts

@@ -22,6 +22,7 @@ export interface UpdateEnvVariableOptions {
  * - **Duplicate keys**: updates the LAST occurrence (matches dotenv behavior)
  * - **Inline comments**: preserved after the value (e.g., `KEY=value # comment`)
  * - **Quote style**: preserved from original (quoted/unquoted)
+ * - **`export ` prefix**: preserved when updating an `export KEY=…` line
  *
  * @warning Not atomic; not safe for concurrent writers. Reads the file, mutates
  * in memory, then writes it back — a crash or concurrent write can corrupt

package/dist/env/update_env_variable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update_env_variable.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/env/update_env_variable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,MAAM,EACX,OAAO,MAAM,EACb,SAAS,wBAAwB,KAC/B,OAAO,CAAC,IAAI,CAmDd,CAAC"}
+{"version":3,"file":"update_env_variable.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/env/update_env_variable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,MAAM,EACX,OAAO,MAAM,EACb,SAAS,wBAAwB,KAC/B,OAAO,CAAC,IAAI,CAsDd,CAAC"}

package/dist/env/update_env_variable.js

@@ -13,6 +13,7 @@ import { resolve } from 'node:path';
  * - **Duplicate keys**: updates the LAST occurrence (matches dotenv behavior)
  * - **Inline comments**: preserved after the value (e.g., `KEY=value # comment`)
  * - **Quote style**: preserved from original (quoted/unquoted)
+ * - **`export ` prefix**: preserved when updating an `export KEY=…` line
  *
  * @warning Not atomic; not safe for concurrent writers. Reads the file, mutates
  * in memory, then writes it back — a crash or concurrent write can corrupt
@@ -49,14 +50,17 @@ export const update_env_variable = async (key, value, options) => {
     const last_match_idx = find_last_key_line_index(lines, key);
     const updated_lines = lines.map((line, idx) => {
         if (idx === last_match_idx) {
+            // preserve a leading `export ` (the rest of the line's leading
+            // whitespace is normalized away, same as for a plain assignment)
+            const export_prefix = line.trimStart().startsWith('export ') ? 'export ' : '';
             const equals_pos = line.indexOf('=');
             const value_part = line.substring(equals_pos + 1);
             const inline_comment = extract_inline_comment(value_part);
             const trimmed_value = value_part.trim();
             const has_quotes = is_quoted_value(trimmed_value);
             return has_quotes
-                ? `${key}=${quote_value(value)}${inline_comment}`
-                : `${key}=${value}${inline_comment}`;
+                ? `${export_prefix}${key}=${quote_value(value)}${inline_comment}`
+                : `${export_prefix}${key}=${value}${inline_comment}`;
         }
         return line;
     });
@@ -71,7 +75,7 @@ export const update_env_variable = async (key, value, options) => {
     await write_file(file_path, updated_content, 'utf-8');
 };
 // Keep this tokenization aligned with `parse_dotenv` in `env/dotenv.ts`:
-// trim, skip empties/comments, split on the first `=`.
+// trim, skip empties/comments, strip a leading `export `, split on the first `=`.
 const find_last_key_line_index = (lines, key) => {
     if (!key)
         return -1;
@@ -80,10 +84,11 @@ const find_last_key_line_index = (lines, key) => {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith('#'))
             return;
-        const eq_index = trimmed.indexOf('=');
+        const assignment = trimmed.startsWith('export ') ? trimmed.slice(7) : trimmed;
+        const eq_index = assignment.indexOf('=');
         if (eq_index === -1)
             return;
-        if (trimmed.slice(0, eq_index).trim() === key)
+        if (assignment.slice(0, eq_index).trim() === key)
             last_match_idx = idx;
     });
     return last_match_idx;

package/dist/server/serve_fact_route.d.ts

@@ -14,8 +14,11 @@
  * (filesystem-backed `file:<shard>/<rest>` URLs) either return an
  * `X-Accel-Redirect` header pointing into nginx's internal facts location
  * (production) or stream from disk via the filesystem `FactExternalFetcher`
- * (dev / tests). The runtime mode is selected by the optional
- * `x_accel_redirect_prefix` factory option — set in prod, unset in dev.
+ * (dev / tests). The runtime mode is selected by the optional `x_accel`
+ * factory option — a validated `XAccelConfig` (built via
+ * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
+ * The handle can only be obtained by proving the facts nginx location is
+ * `internal;`, so X-Accel serving can't be enabled against a public location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -87,6 +90,7 @@
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RouteSpec } from '../http/route_spec.js';
 import type { AppDeps } from '../auth/deps.js';
+import type { XAccelConfig } from './x_accel.js';
 export interface CreateServeFactRouteSpecOptions {
     /**
      * App deps reference. Currently unused at handler time (cell + fact
@@ -100,12 +104,13 @@ export interface CreateServeFactRouteSpecOptions {
     facts_dir: string;
     /**
      * When set, external facts return an `X-Accel-Redirect` pointing at
-     * `${prefix}<shard>/<rest>` — nginx's internal facts location serves
-     * the bytes. When unset, external facts stream from
-     * `<facts_dir>/<shard>/<rest>` directly. Production sets this (e.g.
-     * `/_facts/`); tests + dev leave it unset.
+     * `${x_accel.redirect_prefix}<shard>/<rest>` — nginx's internal facts
+     * location serves the bytes. When unset, external facts stream from
+     * `<facts_dir>/<shard>/<rest>` directly. Production sets a validated
+     * `XAccelConfig` (built via `create_x_accel_config`, which proves the
+     * facts location is `internal;`); tests + dev leave it unset.
      */
-    x_accel_redirect_prefix?: string;
+    x_accel?: XAccelConfig;
     log: Logger;
 }
 /**

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAkE7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAM7C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC;AA6D/C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -14,8 +14,11 @@
  * (filesystem-backed `file:<shard>/<rest>` URLs) either return an
  * `X-Accel-Redirect` header pointing into nginx's internal facts location
  * (production) or stream from disk via the filesystem `FactExternalFetcher`
- * (dev / tests). The runtime mode is selected by the optional
- * `x_accel_redirect_prefix` factory option — set in prod, unset in dev.
+ * (dev / tests). The runtime mode is selected by the optional `x_accel`
+ * factory option — a validated `XAccelConfig` (built via
+ * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
+ * The handle can only be obtained by proving the facts nginx location is
+ * `internal;`, so X-Accel serving can't be enabled against a public location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -167,7 +170,7 @@ const params_400_error = {
  * fact is genuinely absent or merely unviewable.
  */
 const serve_fact_bytes = async (c, route, hash, config) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = config;
+    const { facts_dir, x_accel, log } = config;
     const meta = await query_get_fact_meta({ db: route.db }, hash);
     if (!meta) {
         return c.body(null, 404);
@@ -198,13 +201,13 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         return c.body(null, 404);
     }
     const { shard, rest } = parsed;
-    if (x_accel_redirect_prefix !== undefined) {
-        // Production: hand off to nginx via the internal facts location.
+    if (x_accel !== undefined) {
+        // Production: hand off to nginx via the validated `internal;` facts location.
         return c.body(null, 200, {
             'Content-Type': content_type,
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
-            'X-Accel-Redirect': `${x_accel_redirect_prefix}${shard}/${rest}`,
+            'X-Accel-Redirect': `${x_accel.redirect_prefix}${shard}/${rest}`,
             ...FACT_SECURITY_HEADERS,
         });
     }
@@ -252,8 +255,8 @@ const build_public_request_context = async (c, route) => {
  * from `c.var.account_id` and enforces visibility per-reference.
  */
 export const create_serve_cell_fact_route_spec = (options) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = options;
-    const config = { facts_dir, x_accel_redirect_prefix, log };
+    const { facts_dir, x_accel, log } = options;
+    const config = { facts_dir, x_accel, log };
     return {
         method: 'GET',
         path: '/api/cells/:cell_id/facts/:hash',
@@ -310,8 +313,8 @@ export const create_serve_cell_fact_route_spec = (options) => {
  * hash to a non-admin.
  */
 export const create_serve_fact_route_spec = (options) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = options;
-    const config = { facts_dir, x_accel_redirect_prefix, log };
+    const { facts_dir, x_accel, log } = options;
+    const config = { facts_dir, x_accel, log };
     return {
         method: 'GET',
         path: '/api/facts/:hash',

package/dist/server/x_accel.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Fail-loud validation of the X-Accel facts nginx location.
+ *
+ * The `X-Accel-Redirect` serving path's confidentiality depends on the facts
+ * nginx location being `internal;` — only the authz'd handler's redirect (an
+ * internal subrequest) may reach it. A *public* facts location would serve any
+ * fact's bytes to anyone who guesses the `<shard>/<rest>` path, bypassing every
+ * cell-visibility check. `XAccelConfig` makes that assertion structural: a
+ * consumer can only obtain the redirect prefix by building an `XAccelConfig`,
+ * which runs this check and throws **loudly** on a missing or non-`internal;`
+ * location — it cannot silently fall closed.
+ *
+ * This is a best-effort string check (brace-matched `location` blocks), the TS
+ * twin of the Rust `fuz_fact_serving` `nginx.rs` — not a real nginx parser, but
+ * it catches the security-critical omission. Distinct from
+ * `validate_nginx_config` (`server/validate_nginx.ts`), which validates the
+ * `/api` Authorization-strip + security headers and takes no facts-location
+ * path.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Result of the facts-location check. */
+export interface NginxFactsValidation {
+    /** `true` when the facts location exists and is `internal;`. */
+    ok: boolean;
+    /** Fatal issues — a missing or non-`internal` facts location. */
+    errors: Array<string>;
+}
+/**
+ * Assert the nginx `location` serving the X-Accel facts prefix is `internal;`.
+ *
+ * `facts_location` is the path the X-Accel redirect prefix points at (e.g.
+ * `/_facts/`). Returns a fatal error when no matching `location` block exists,
+ * or when the matching block is not marked `internal;` — either is a public
+ * facts location that bypasses cell visibility.
+ *
+ * @param config - the nginx config template string to check
+ * @param facts_location - the facts location path the redirect prefix points at
+ * @returns `{ok, errors}` — `ok` is `true` only when the location exists and is `internal;`
+ */
+export declare const validate_facts_internal_location: (config: string, facts_location: string) => NginxFactsValidation;
+/**
+ * A validated X-Accel redirect configuration — the only handle that enables the
+ * `X-Accel-Redirect` serving path in `server/serve_fact_route.ts`.
+ *
+ * The redirect prefix can be obtained **only** by passing the nginx config
+ * through `validate_facts_internal_location` (via `create_x_accel_config`), so
+ * X-Accel serving is impossible to enable without proving the facts location is
+ * `internal;` at boot — a public facts location would bypass every
+ * cell-visibility check. A Zod-branded type: the brand can't be forged without
+ * an explicit cast, so the factory is the only ordinary construction path.
+ */
+export declare const XAccelConfig: z.core.$ZodBranded<z.ZodObject<{
+    /** The validated redirect prefix the serving path prepends (e.g. `/_facts/`). */
+    redirect_prefix: z.ZodString;
+}, z.core.$strict>, "XAccelConfig", "out">;
+export type XAccelConfig = z.infer<typeof XAccelConfig>;
+/**
+ * A misconfigured X-Accel facts location — a fail-loud boot error thrown by
+ * `create_x_accel_config`.
+ */
+export declare class XAccelConfigError extends Error {
+    /** The validator errors that made the location unsafe. */
+    readonly errors: Array<string>;
+    constructor(errors: Array<string>);
+}
+/**
+ * Build a validated `XAccelConfig`, asserting the nginx `location` serving
+ * `redirect_prefix` is `internal;`.
+ *
+ * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
+ * into a location proven `internal;` at boot.
+ *
+ * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param nginx_config - the nginx config template string to validate against
+ * @returns the validated `XAccelConfig` carrying `redirect_prefix`
+ * @throws `XAccelConfigError` when `nginx_config` has no matching `location` for
+ *   `redirect_prefix`, or the matching block is not marked `internal;` — either
+ *   is a public facts location that bypasses every cell-visibility check.
+ */
+export declare const create_x_accel_config: (redirect_prefix: string, nginx_config: string) => XAccelConfig;
+//# sourceMappingURL=x_accel.d.ts.map

package/dist/server/x_accel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x_accel.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/x_accel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,gEAAgE;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAuDD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gCAAgC,GAC5C,QAAQ,MAAM,EACd,gBAAgB,MAAM,KACpB,oBAqBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;IAEvB,iFAAiF;;0CAG5D,CAAC;AACxB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;CAKjC;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,iBAAiB,MAAM,EACvB,cAAc,MAAM,KAClB,YAMF,CAAC"}

package/dist/server/x_accel.js

@@ -0,0 +1,148 @@
+/**
+ * Fail-loud validation of the X-Accel facts nginx location.
+ *
+ * The `X-Accel-Redirect` serving path's confidentiality depends on the facts
+ * nginx location being `internal;` — only the authz'd handler's redirect (an
+ * internal subrequest) may reach it. A *public* facts location would serve any
+ * fact's bytes to anyone who guesses the `<shard>/<rest>` path, bypassing every
+ * cell-visibility check. `XAccelConfig` makes that assertion structural: a
+ * consumer can only obtain the redirect prefix by building an `XAccelConfig`,
+ * which runs this check and throws **loudly** on a missing or non-`internal;`
+ * location — it cannot silently fall closed.
+ *
+ * This is a best-effort string check (brace-matched `location` blocks), the TS
+ * twin of the Rust `fuz_fact_serving` `nginx.rs` — not a real nginx parser, but
+ * it catches the security-critical omission. Distinct from
+ * `validate_nginx_config` (`server/validate_nginx.ts`), which validates the
+ * `/api` Authorization-strip + security headers and takes no facts-location
+ * path.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Strip every trailing `/` so `/_facts/` and `/_facts` compare equal. */
+const trim_trailing_slashes = (value) => value.replace(/\/+$/, '');
+/** `true` if a location block body contains an `internal` directive. */
+const is_internal = (content) => content.split(/[;\s]+/).some((token) => token === 'internal');
+/**
+ * Extract `{path, content}` for each `location … { … }` block, brace-matched so
+ * nested blocks are kept whole. `path` is the last whitespace token before the
+ * opening brace (the location path, after any modifier). Best-effort: a stray
+ * `location` token in a comment can produce a spurious block, harmless for this
+ * check.
+ */
+const find_location_blocks = (config) => {
+    const blocks = [];
+    let search = 0;
+    let kw;
+    while ((kw = config.indexOf('location', search)) !== -1) {
+        // Require a token boundary before `location` (start or whitespace) so
+        // `relocation` etc. don't match.
+        const boundary_ok = kw === 0 || /\s/.test(config[kw - 1]);
+        const after = kw + 'location'.length;
+        const brace = config.indexOf('{', after);
+        if (brace === -1)
+            break;
+        if (!boundary_ok) {
+            search = after;
+            continue;
+        }
+        const header = config.slice(after, brace).trim();
+        const tokens = header.split(/\s+/).filter((token) => token.length > 0);
+        const path = tokens.length > 0 ? tokens[tokens.length - 1] : '';
+        // Brace-match the body.
+        let depth = 1;
+        let i = brace + 1;
+        while (i < config.length && depth > 0) {
+            const ch = config[i];
+            if (ch === '{')
+                depth++;
+            else if (ch === '}')
+                depth--;
+            i++;
+        }
+        blocks.push({ path, content: config.slice(brace, i) });
+        search = i;
+    }
+    return blocks;
+};
+/**
+ * Assert the nginx `location` serving the X-Accel facts prefix is `internal;`.
+ *
+ * `facts_location` is the path the X-Accel redirect prefix points at (e.g.
+ * `/_facts/`). Returns a fatal error when no matching `location` block exists,
+ * or when the matching block is not marked `internal;` — either is a public
+ * facts location that bypasses cell visibility.
+ *
+ * @param config - the nginx config template string to check
+ * @param facts_location - the facts location path the redirect prefix points at
+ * @returns `{ok, errors}` — `ok` is `true` only when the location exists and is `internal;`
+ */
+export const validate_facts_internal_location = (config, facts_location) => {
+    const errors = [];
+    const normalized = trim_trailing_slashes(facts_location);
+    const blocks = find_location_blocks(config);
+    const matching = blocks.filter((block) => trim_trailing_slashes(block.path) === normalized);
+    if (matching.length === 0) {
+        errors.push(`No nginx \`location ${facts_location}\` block found — the X-Accel facts location must ` +
+            `exist and be marked \`internal;\` so only the authz'd handler's redirect can reach it. ` +
+            `A public facts location bypasses every cell-visibility check.`);
+    }
+    else if (!matching.some((block) => is_internal(block.content))) {
+        errors.push(`nginx \`location ${facts_location}\` is NOT marked \`internal;\` — a public facts ` +
+            `location serves any fact's bytes to anyone who guesses the path, bypassing every ` +
+            `cell-visibility check. Add \`internal;\` to the block.`);
+    }
+    return { ok: errors.length === 0, errors };
+};
+/**
+ * A validated X-Accel redirect configuration — the only handle that enables the
+ * `X-Accel-Redirect` serving path in `server/serve_fact_route.ts`.
+ *
+ * The redirect prefix can be obtained **only** by passing the nginx config
+ * through `validate_facts_internal_location` (via `create_x_accel_config`), so
+ * X-Accel serving is impossible to enable without proving the facts location is
+ * `internal;` at boot — a public facts location would bypass every
+ * cell-visibility check. A Zod-branded type: the brand can't be forged without
+ * an explicit cast, so the factory is the only ordinary construction path.
+ */
+export const XAccelConfig = z
+    .strictObject({
+    /** The validated redirect prefix the serving path prepends (e.g. `/_facts/`). */
+    redirect_prefix: z.string(),
+})
+    .brand('XAccelConfig');
+/**
+ * A misconfigured X-Accel facts location — a fail-loud boot error thrown by
+ * `create_x_accel_config`.
+ */
+export class XAccelConfigError extends Error {
+    /** The validator errors that made the location unsafe. */
+    errors;
+    constructor(errors) {
+        super(`X-Accel facts location is not safely \`internal;\`: ${errors.join('; ')}`);
+        this.name = 'XAccelConfigError';
+        this.errors = errors;
+    }
+}
+/**
+ * Build a validated `XAccelConfig`, asserting the nginx `location` serving
+ * `redirect_prefix` is `internal;`.
+ *
+ * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
+ * into a location proven `internal;` at boot.
+ *
+ * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param nginx_config - the nginx config template string to validate against
+ * @returns the validated `XAccelConfig` carrying `redirect_prefix`
+ * @throws `XAccelConfigError` when `nginx_config` has no matching `location` for
+ *   `redirect_prefix`, or the matching block is not marked `internal;` — either
+ *   is a public facts location that bypasses every cell-visibility check.
+ */
+export const create_x_accel_config = (redirect_prefix, nginx_config) => {
+    const validation = validate_facts_internal_location(nginx_config, redirect_prefix);
+    if (!validation.ok) {
+        throw new XAccelConfigError(validation.errors);
+    }
+    return XAccelConfig.parse({ redirect_prefix });
+};

package/dist/testing/CLAUDE.md

@@ -1347,8 +1347,9 @@ the same reasons the sibling `cross_backend/origin.ts` suite is imperative.
 Both backends read the **same** committed
 `testing/cross_backend/expected_schema.json` (column-presence is engine-portable,
 so one fixture is the cross-impl contract): the TS spine via
-`create_spine_ready_route_spec` (an `import.meta.url` URL off `default_spine_surface.ts`),
-the Rust `testing_spine_stub` via the absolute path `rust_spine_stub_backend_config`
+`create_spine_ready_route_spec`, which reads the `SPINE_EXPECTED_SCHEMA_URL`
+`import.meta.url` constant off `spine_surface_constants.ts`; the Rust
+`testing_spine_stub` via the absolute path `rust_spine_stub_backend_config`
 passes through `FUZ_RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH`. The fixture covers the full
 spine bootstrap (auth + cell + cell_history + fact) and is regenerated +
 drift-guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`

package/dist/testing/cross_backend/account_lifecycle.js

@@ -22,7 +22,7 @@ import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAc
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_account_lifecycle_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;

package/dist/testing/cross_backend/actor_lookup.js

@@ -32,7 +32,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { actor_lookup_action_spec } from '../../auth/actor_lookup_action_specs.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Keys that must never appear on an `actor_lookup` result row. */
 const forbidden_row_keys = ['account_id', 'email', 'created_at', 'updated_at', 'role'];
 /** Build the JSON-RPC envelope body for an `actor_lookup` call. */

package/dist/testing/cross_backend/actor_search.js

@@ -35,7 +35,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { actor_search_action_spec, ERROR_ACTOR_SEARCH_SCOPE_REQUIRED, } from '../../auth/actor_search_action_specs.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Nil UUID — an unheld scope id (no actor holds a role_grant on it). */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /** Build the JSON-RPC envelope body for an `actor_search` call. */

package/dist/testing/cross_backend/app_settings.js

@@ -33,7 +33,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { app_settings_update_action_spec } from '../../auth/admin_action_specs.js';
 import { ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** REST signup path on the spine surface (`/api/account` prefix + `/signup`). */
 const SIGNUP_PATH = '/api/account/signup';
 /** A password that satisfies the creation-strength schema (min 12). */

package/dist/testing/cross_backend/body_size.js

@@ -55,7 +55,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
 import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * The shared 1 MiB default both impls ship (`DEFAULT_MAX_BODY_SIZE` in TS,
  * `DEFAULT_BODY_LIMIT_BYTES` in `fuz_http`). Kept as a local cross-impl

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -50,7 +50,7 @@ import '../assert_dev_env.js';
  */
 import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
 const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
 /**

package/dist/testing/cross_backend/cell_crud.js

@@ -43,7 +43,7 @@ import { describe, assert } from 'vitest';
 import { CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput, } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_cell_crud_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;

package/dist/testing/cross_backend/cell_grant_role.js

@@ -38,7 +38,7 @@ import { CellCreateOutput, CellGetOutput, CellUpdateOutput } from '../../auth/ce
 import { CellGrantCreateOutput, ERROR_CELL_GRANT_UNKNOWN_ROLE, } from '../../auth/cell_grant_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
-import { SPINE_CELL_EDITOR_ROLE, SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_CELL_EDITOR_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** App role the holder is seeded with; matches the spine's registered role. */
 export const CELL_EDITOR_ROLE = SPINE_CELL_EDITOR_ROLE;
 /** Username the fixture seeds (via `extra_accounts`) holding `CELL_EDITOR_ROLE`. */

package/dist/testing/cross_backend/cell_relations.js

@@ -61,7 +61,7 @@ import { CellItemDeleteOutput, CellItemInsertOutput, CellItemListOutput, CellIte
 import { CellAuditListOutput } from '../../auth/cell_audit_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Create a cell over the wire and return its id (the parity gate parses the output). */
 const create_cell = async (t, rpc_path, h, params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', params, h), CellCreateOutput).cell
     .id;

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -51,7 +51,7 @@ import '../assert_dev_env.js';
 import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /** A value that is never a real credential — used for the conflicting / garbage copies. */

package/dist/testing/cross_backend/default_spine_surface.d.ts

@@ -35,14 +35,6 @@ import type { AppServerContext } from '../../server/app_server_context.js';
  * (`fuz_session`) so cookie-attribute assertions + jar extraction line up.
  */
 export declare const spine_session_options: SessionOptions<string>;
-/**
- * App role the role-shaped-`cell_grant` cross suite exercises. Registered
- * with no grant path (`grant_paths: []`) so it stays a valid registry member
- * without entering the admin / self-service grant flows — holders are seeded
- * directly via `extra_accounts`. Must match the `cell_editor` entry in the
- * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
- */
-export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
 /**
  * The spine's closed role registry: built-ins plus `SPINE_CELL_EDITOR_ROLE`.
  * Threaded into the cell spec set's role-validity gate; the Rust stub mirrors
@@ -51,16 +43,6 @@ export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
  * picks up grant-path coverage.
  */
 export declare const spine_roles: RoleSchemaResult;
-/** RPC endpoint mount path — matches the binary's `/api/rpc`. */
-export declare const SPINE_RPC_PATH = "/api/rpc";
-/**
- * Audit-log SSE stream path — `/api/admin` prefix + the
- * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
- * `BackendConfig.sse_path` and the cross-process SSE suite's default. Only
- * mounted by the TS spine binary (which wires `audit_log_sse`); the shared
- * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
- */
-export declare const SPINE_SSE_PATH = "/api/admin/audit/stream";
 /** Options for {@link spine_rpc_endpoints}. */
 export interface SpineRpcEndpointsOptions {
     /**
@@ -109,18 +91,6 @@ export declare const spine_rpc_endpoints: (ctx: AppServerContext, options?: Spin
  * the stream at `SPINE_SSE_PATH`.
  */
 export declare const create_spine_route_specs: (ctx: AppServerContext) => Array<RouteSpec>;
-/**
- * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
- * produces. Resolved relative to this module so the spawned TS binary (which
- * imports this source under its loader) reads it off disk via `node:fs`.
- * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.
- *
- * The Rust `testing_spine_stub` reads the **same** committed file (its absolute
- * path passed via env by `rust_spine_stub_backend_config`) — column-presence is
- * engine-portable, so one fixture is the cross-impl contract.
- */
-export declare const SPINE_EXPECTED_SCHEMA_URL: URL;
 /**
  * The spine's `/ready` route spec — the column-presence schema-drift deploy
  * gate, reading {@link SPINE_EXPECTED_SCHEMA_URL}. Mounted **live** by the TS

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAczE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -8,19 +8,17 @@ import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js'
 import { create_ready_route_spec, load_expected_schema } from '../../http/common_routes.js';
 import { prefix_route_specs } from '../../http/route_spec.js';
 import { create_test_app_surface_spec } from '../stubs.js';
+// Pure path / role / fixture-URL constants live on the hono-free
+// `spine_surface_constants.ts` leaf so cross-process suite modules can import them
+// without dragging this module's eager in-process route handlers
+// (→ `session_middleware` → `hono/cookie`). Import only the constants this
+// module uses internally; callers that need a bare constant reach for the leaf.
+import { SPINE_CELL_EDITOR_ROLE, SPINE_EXPECTED_SCHEMA_URL, SPINE_RPC_PATH, } from './spine_surface_constants.js';
 /**
  * Session config — cookie name matches the binary's issued session cookie
  * (`fuz_session`) so cookie-attribute assertions + jar extraction line up.
  */
 export const spine_session_options = create_session_config('fuz_session');
-/**
- * App role the role-shaped-`cell_grant` cross suite exercises. Registered
- * with no grant path (`grant_paths: []`) so it stays a valid registry member
- * without entering the admin / self-service grant flows — holders are seeded
- * directly via `extra_accounts`. Must match the `cell_editor` entry in the
- * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
- */
-export const SPINE_CELL_EDITOR_ROLE = 'cell_editor';
 /**
  * The spine's closed role registry: built-ins plus `SPINE_CELL_EDITOR_ROLE`.
  * Threaded into the cell spec set's role-validity gate; the Rust stub mirrors
@@ -31,16 +29,6 @@ export const SPINE_CELL_EDITOR_ROLE = 'cell_editor';
 export const spine_roles = create_role_schema([
     { name: SPINE_CELL_EDITOR_ROLE, grant_paths: [] },
 ]);
-/** RPC endpoint mount path — matches the binary's `/api/rpc`. */
-export const SPINE_RPC_PATH = '/api/rpc';
-/**
- * Audit-log SSE stream path — `/api/admin` prefix + the
- * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
- * `BackendConfig.sse_path` and the cross-process SSE suite's default. Only
- * mounted by the TS spine binary (which wires `audit_log_sse`); the shared
- * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
- */
-export const SPINE_SSE_PATH = '/api/admin/audit/stream';
 /**
  * Factory-form RPC endpoints over the per-test `ctx.deps`. `create_app_server`
  * (in the binary) owns live dispatch; the surface builder invokes the factory
@@ -105,18 +93,6 @@ export const create_spine_route_specs = (ctx) => [
         ? prefix_route_specs('/api/admin', create_audit_log_route_specs({ stream: ctx.audit_sse }))
         : []),
 ];
-/**
- * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
- * produces. Resolved relative to this module so the spawned TS binary (which
- * imports this source under its loader) reads it off disk via `node:fs`.
- * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.
- *
- * The Rust `testing_spine_stub` reads the **same** committed file (its absolute
- * path passed via env by `rust_spine_stub_backend_config`) — column-presence is
- * engine-portable, so one fixture is the cross-impl contract.
- */
-export const SPINE_EXPECTED_SCHEMA_URL = new URL('./expected_schema.json', import.meta.url);
 /**
  * The spine's `/ready` route spec — the column-presence schema-drift deploy
  * gate, reading {@link SPINE_EXPECTED_SCHEMA_URL}. Mounted **live** by the TS

package/dist/testing/cross_backend/fact_serving.js

@@ -42,7 +42,7 @@ import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
 import { CellCreateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A blake3 hash that is a valid form but references no seeded fact. */
 const UNRELATED_HASH = `blake3:${'0'.repeat(64)}`;
 /** Nil UUID — a valid `Uuid` param that resolves to no cell. */

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAOzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0BjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAQzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0BjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,7 +5,8 @@ import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
 import { create_testing_action_manifest_action, create_testing_actions, } from './testing_reset_actions.js';
-import { SPINE_RPC_PATH, spine_roles, spine_session_options } from './default_spine_surface.js';
+import { spine_roles, spine_session_options } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * Build the complete live RPC action list the spine test binary mounts on
  * its single endpoint: the declared `create_standard_rpc_actions` bundle plus

package/dist/testing/cross_backend/origin.js

@@ -29,7 +29,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
 import { ERROR_FORBIDDEN_ORIGIN } from '../../http/error_schemas.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
 const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
 export const describe_origin_cross_tests = (options) => {

package/dist/testing/cross_backend/role_grant_offer_enumeration.js

@@ -46,7 +46,7 @@ import { describe, test, assert } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, } from '../../auth/role_grant_offer_action_specs.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real offer — exercises the not-found arm. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -35,7 +35,7 @@ import '../assert_dev_env.js';
  */
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { SPINE_EXPECTED_SCHEMA_URL } from './default_spine_surface.js';
+import { SPINE_EXPECTED_SCHEMA_URL } from './spine_surface_constants.js';
 import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -0,0 +1,47 @@
+import '../assert_dev_env.js';
+/**
+ * Pure spine-surface path + role constants — the hono-free leaf split out of
+ * `default_spine_surface.ts`.
+ *
+ * Cross-process suite modules (which drive a separately-spawned backend binary
+ * over HTTP) need only the wire path / role / fixture-URL, not the in-process
+ * route handlers. Importing them from `default_spine_surface.ts` used to drag
+ * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
+ * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
+ * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
+ * on this handler-free leaf lets such a consumer import the path without the
+ * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ *
+ * @module
+ */
+/** RPC endpoint mount path — matches the binary's `/api/rpc`. */
+export declare const SPINE_RPC_PATH = "/api/rpc";
+/**
+ * Audit-log SSE stream path — `/api/admin` prefix + the
+ * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
+ * `BackendConfig.sse_path` and the cross-process SSE suite's default. Only
+ * mounted by the TS spine binary (which wires `audit_log_sse`); the shared
+ * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
+ */
+export declare const SPINE_SSE_PATH = "/api/admin/audit/stream";
+/**
+ * App role the role-shaped-`cell_grant` cross suite exercises. Registered
+ * with no grant path (`grant_paths: []`) so it stays a valid registry member
+ * without entering the admin / self-service grant flows — holders are seeded
+ * directly via `extra_accounts`. Must match the `cell_editor` entry in the
+ * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
+ */
+export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
+/**
+ * Committed expected-schema fixture for the spine `/ready` deploy gate — the
+ * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * produces. Resolved relative to this module so the spawned TS binary (which
+ * imports this source under its loader) reads it off disk via `node:fs`.
+ * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.
+ *
+ * The Rust `testing_spine_stub` reads the **same** committed file (its absolute
+ * path passed via env by `rust_spine_stub_backend_config`) — column-presence is
+ * engine-portable, so one fixture is the cross-impl contract.
+ */
+export declare const SPINE_EXPECTED_SCHEMA_URL: URL;
+//# sourceMappingURL=spine_surface_constants.d.ts.map

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -0,0 +1,46 @@
+import '../assert_dev_env.js';
+/**
+ * Pure spine-surface path + role constants — the hono-free leaf split out of
+ * `default_spine_surface.ts`.
+ *
+ * Cross-process suite modules (which drive a separately-spawned backend binary
+ * over HTTP) need only the wire path / role / fixture-URL, not the in-process
+ * route handlers. Importing them from `default_spine_surface.ts` used to drag
+ * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
+ * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
+ * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
+ * on this handler-free leaf lets such a consumer import the path without the
+ * peer. `default_spine_surface.ts` re-exports them for in-process callers.
+ *
+ * @module
+ */
+/** RPC endpoint mount path — matches the binary's `/api/rpc`. */
+export const SPINE_RPC_PATH = '/api/rpc';
+/**
+ * Audit-log SSE stream path — `/api/admin` prefix + the
+ * `create_audit_log_route_specs` `/audit/stream` route. Matches the default
+ * `BackendConfig.sse_path` and the cross-process SSE suite's default. Only
+ * mounted by the TS spine binary (which wires `audit_log_sse`); the shared
+ * surface stub leaves `ctx.audit_sse` null so the snapshot stays SSE-free.
+ */
+export const SPINE_SSE_PATH = '/api/admin/audit/stream';
+/**
+ * App role the role-shaped-`cell_grant` cross suite exercises. Registered
+ * with no grant path (`grant_paths: []`) so it stays a valid registry member
+ * without entering the admin / self-service grant flows — holders are seeded
+ * directly via `extra_accounts`. Must match the `cell_editor` entry in the
+ * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
+ */
+export const SPINE_CELL_EDITOR_ROLE = 'cell_editor';
+/**
+ * Committed expected-schema fixture for the spine `/ready` deploy gate — the
+ * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * produces. Resolved relative to this module so the spawned TS binary (which
+ * imports this source under its loader) reads it off disk via `node:fs`.
+ * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.
+ *
+ * The Rust `testing_spine_stub` reads the **same** committed file (its absolute
+ * path passed via env by `rust_spine_stub_backend_config`) — column-presence is
+ * engine-portable, so one fixture is the cross-impl contract.
+ */
+export const SPINE_EXPECTED_SCHEMA_URL = new URL('./expected_schema.json', import.meta.url);

package/dist/testing/cross_backend/testing_backdoor.js

@@ -53,7 +53,7 @@ import '../assert_dev_env.js';
 import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { rpc_call } from '../rpc_helpers.js';
-import { SPINE_RPC_PATH } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -19,17 +19,6 @@ import '../assert_dev_env.js';
 import type { BackendConfig } from './backend_config.js';
 /** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
 export declare const TS_SPINE_DIR_ENV = "FUZ_TESTING_TS_SPINE_DIR";
-/**
- * Audit-log SSE stream path the TS spine binary serves (it wires
- * `audit_log_sse`). Matches `SPINE_SSE_PATH` in `testing/cross_backend/default_spine_surface.ts`
- * and the cross-process SSE suite's default. Scoped to the TS configs
- * (which advertise `capabilities.sse: true`) — the shared
- * `ts_default_capabilities` stays `sse: false` because not every consumer
- * wires `audit_log_sse`, so the default stays honest for backends that don't
- * serve the stream. (The Rust `testing_spine_stub` does serve it and opts in
- * via `rust_spine_stub_backend_config`.)
- */
-export declare const TS_SPINE_SSE_PATH = "/api/admin/audit/stream";
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */
 export declare const TS_SPINE_NODE_DEFAULT_PORT = 1178;
 /** Default port for the Deno TS spine binary. */

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AA+B3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA+B3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,19 +1,9 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_ts_backend_config, ts_default_capabilities, } from './default_backend_configs.js';
+import { SPINE_SSE_PATH } from './spine_surface_constants.js';
 /** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
 export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
-/**
- * Audit-log SSE stream path the TS spine binary serves (it wires
- * `audit_log_sse`). Matches `SPINE_SSE_PATH` in `testing/cross_backend/default_spine_surface.ts`
- * and the cross-process SSE suite's default. Scoped to the TS configs
- * (which advertise `capabilities.sse: true`) — the shared
- * `ts_default_capabilities` stays `sse: false` because not every consumer
- * wires `audit_log_sse`, so the default stays honest for backends that don't
- * serve the stream. (The Rust `testing_spine_stub` does serve it and opts in
- * via `rust_spine_stub_backend_config`.)
- */
-export const TS_SPINE_SSE_PATH = '/api/admin/audit/stream';
 /**
  * Capabilities for the TS spine binary — `ts_default_capabilities` plus `sse`
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the
@@ -81,7 +71,7 @@ export const ts_spine_node_backend_config = (options = {}) => {
             },
             capabilities: ts_spine_capabilities,
         }),
-        sse_path: TS_SPINE_SSE_PATH,
+        sse_path: SPINE_SSE_PATH,
     };
 };
 /**
@@ -107,7 +97,7 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             },
             capabilities: ts_spine_bun_capabilities,
         }),
-        sse_path: TS_SPINE_SSE_PATH,
+        sse_path: SPINE_SSE_PATH,
     };
 };
 /**
@@ -151,6 +141,6 @@ export const ts_spine_deno_backend_config = (options = {}) => {
             },
             capabilities: ts_spine_capabilities,
         }),
-        sse_path: TS_SPINE_SSE_PATH,
+        sse_path: SPINE_SSE_PATH,
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.99.0",
+  "version": "0.101.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",